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DEFINE ENTITIES OF PERMISSION STRUCTURE 



^- 502 

I ( 

ORGANIZE ENTITIES INTO A TREE STRUCTURE FOR SPECIFYING 
RELATIONSHIPS BETWEEN ENTITLEMENT GROUPS AND OTHER 

ENTITIES 



^503 
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ENTITLEMENTS (PRIVILEGES) OF EACH ENTITLEMENT GROUP 
DEFINED BY REMOVING (OR RESTRICTING) ENTITLEMENTS 
INHERITED FROM ITS PARENT GROUP 
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USER ATTEMPTS TO PERFORM AN OPERATION AT RUNTIME 
(E.G., WIRE TRANSFER FROM A PARTICULAR ACCOUNT) 
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COMMENCE ENTITLEMENT CHECK BY IDENTIFYING GROUP 
MEMBER ATTEMPTING TO PERFORM OPERATION 
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DYNAMICALLY CONSTRUCT SET OF ENTITLEMENTS BASED ON 
ENTITLEMENTS RECORDED FOR GROUP MEMBER, 
ENTITLEMENT GROUP, AND PARENT GROUPS 
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DETERMINE WHETHER GROUP MEMBER IS ENTITLED TO ! 
PERFORM THE OPERATION 
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IF GROUP MEMBER ENTITLED TO PERFORM OPERATION, LOOK 
UP ANY LIMITS APPLICABLE TO GROUP MEMBER, ENTITLEMENT 
GROUP, AND PARENT GROUPS AND RUNNING TOTAL VALUES 
ASSOCIATED WITH LIMITS 
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COMPARE RUNNING TOTAL VALUES TO APPLICABLE LIMITS; 
PROCEED TO STEP 510 OR 51 1 BASED ON RESULTS 
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IF ANY RUNNING TOTAL VALUE EXCEEDS APPLICABLE LIMIT(S), 
RETURN LIST OF LIMITS EXCEEDED 
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OTHERWISE, IF NONE OF RUNNING TOTAL VALUES EXCEED 
APPLICABLE LIMITS, UPDATE RUNNING TOTAL VALUES AND 
RETURN SUCCESS INDICATING GROUP MEMBER ENTITLED TO 
PERFORM OPERATION AND OPERATION IS WITHIN LIMITS 



DONE 
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